Bug 1528072 - Don't overwrite sshd_config
Summary: Don't overwrite sshd_config
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: puppet-tripleo
Version: 8.0 (Liberty)
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: ---
Assignee: RHOS Maint
QA Contact: nlevinki
Depends On:
TreeView+ depends on / blocked
Reported: 2017-12-21 00:03 UTC by Shinobu KINJO
Modified: 2018-06-18 18:52 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2018-06-18 18:52:16 UTC

Attachments (Terms of Use)

Comment 1 Emilien Macchi 2017-12-21 17:13:13 UTC
It's not a problem, it's a feature. We backported a CVE to secure Libvirt and enable SSH auth between compute nodes, for live migration.
If the ssh options don't work for you, you can override them with SshServerOptions parameter.

Example: https://github.com/openstack/tripleo-heat-templates/blob/107b610923ba5d39f90c3a6a63bf2d3642e1b35d/puppet/services/sshd.yaml#L41-L61

Please re-open the bug if needed.

Comment 3 Emilien Macchi 2017-12-30 23:40:56 UTC
I don't think it has to do with the version of openssh. The issue is that:

- before you managed the sshd_config yourself for your own needs
- now, the file is managed by Puppet, but there is an interface that you can use to configure your own needs.

So please, tell us what parameters you need and we'll help you to feed a value to this parameter:

Comment 4 Emilien Macchi 2018-01-08 21:03:49 UTC
Please see my comment #3

Comment 9 Emilien Macchi 2018-01-24 01:16:18 UTC
Like I said, the ssh_config can be overridden via SshServerOptions. Please tell us what you can't do with SshServerOptions otherwise I'll close the bug.

Comment 10 Alex Schultz 2018-06-18 18:52:16 UTC
Closing this out as it is currently configurable using the hieradata_overrides file to specify tripleo::profile::base::sshd::options using the structure mentioned like in https://github.com/openstack/tripleo-heat-templates/blob/107b610923ba5d39f90c3a6a63bf2d3642e1b35d/puppet/services/sshd.yaml#L41-L61

Note You need to log in before you can comment on or make changes to this bug.